MANAGEMENT OF MISBEHAVING NODES IN A COMPUTER NETWORK

• US 20120307624A1
• Filed: 06/01/2011
• Published: 12/06/2012
• Est. Priority Date: 06/01/2011
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Vasseur, Jean-Philippe, Hui, Jonathan W., Shaffer, Shmuel
• Application Number:
  US13/150,866
• Publication Number:
  US 20120307624A1
• Time in Patent Office: Days
• US Class Current: 370/221
• CPC Class Codes: H04L 41/0609 based on severity or priority
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0659 by isolating or reconfiguring faulty entities
• CPC Class Codes: H04L 45/28 using route fault recovery

Abstract

In one embodiment, a node in a computer network detects a misbehaving node in the computer network based on the misbehaving node acting in violation of one or more rules. As such, the node communicates information regarding the misbehaving node to a network management system (NMS), and then may receive isolation instructions from the NMS regarding how to isolate the misbehaving node from the computer network. Accordingly, the node may perform the isolation instructions. In another embodiment, the NMS receives the communicated information regarding the misbehaving node, and determines whether the misbehaving node should be isolated based on the communicated information. If so, then the NMS determines isolation instructions regarding how to isolate the misbehaving node from the computer network, and transmits them to one or more nodes in the computer network, accordingly.

Claims

1. A method, comprising:

detecting, by a node in a computer network, a misbehaving node in the computer network, the misbehaving node detected based on the misbehaving node acting in violation of one or more rules;

communicating information regarding the misbehaving node to a network management system (NMS);

receiving isolation instructions from the NMS regarding how to isolate the misbehaving node from the computer network; and

performing the isolation instructions.

2. The method as in claim 1, wherein the rules comprise hard rules for which a single violation of which results in detecting the misbehaving node, the communicated information comprising identification of the misbehaving node and identification of the one or more violated rules.

3. The method as in claim 1, wherein the rules comprise soft rules for which a decision is made as to whether to detect the misbehaving node based on behavioral analysis, and wherein the communicated information comprises identification of the misbehaving node and identification of the one or more violated rules.

4. The method as in claim 1, wherein the rules comprise soft rules, and wherein the communicated information comprises identification of the misbehaving node and identification of actions performed by the misbehaving node in violation of the soft rules, wherein the NMS is configured to decide whether to isolate the misbehaving node based on behavioral analysis.

5. The method as in claim 1, further comprising:

establishing a secure communication between the node and the NMS for the communicated information and received isolation instructions.

6. The method as in claim 1, wherein the isolation instructions comprise routing isolation instructions, the performing comprising:

ignoring routing protocol messages from the misbehaving node.

7. The method as in claim 1, wherein the isolation instructions comprise network-layer isolation instructions, the performing comprising:

ignoring network-layer messages from the misbehaving node.

8. The method as in claim 1, wherein the isolation instructions comprise link-layer isolation instructions, the performing comprising:

ignoring link-layer messages from the misbehaving node.

9. The method as in claim 8, wherein ignoring comprises operating according to a security key not shared with the misbehaving node.

10. The method as in claim 1, wherein the isolation instructions comprise physical-layer isolation instructions, the performing comprising:

communicating on communication channels other than those used by the misbehaving node.

20. The method as in claim 1, wherein the isolation instructions comprise physical-layer isolation instructions to communicate on communication channels other than those used by the misbehaving node.

11. An apparatus, comprising:

one or more network interfaces to communicate in computer network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

detect a misbehaving node in the computer network, the misbehaving node detected based on the misbehaving node acting in violation of one or more rules;

communicate information regarding the misbehaving node to a network management system (NMS);

receive isolation instructions from the NMS regarding how to isolate the misbehaving node from the computer network; and

perform the isolation instructions.

12. A method, comprising:

receiving, by a network management system (NMS), communicated information regarding a misbehaving node from a detecting node in a computer network, the misbehaving node detected based on the misbehaving node acting in violation of one or more rules;

determining whether the misbehaving node should be isolated based on the communicated information;

determining isolation instructions regarding how to isolate the misbehaving node from the computer network in response to determining to isolate the misbehaving node; and

transmitting the isolation instructions from the NMS to one or more nodes in the computer network.

13. The method as in claim 12, wherein the rules are selected from hard rules for which a single violation of which results in classification as a misbehaving node, and soft rules for which a decision is made as to whether to detect the misbehaving node based on behavioral analysis.

14. The method as in claim 13, wherein determining whether the misbehaving node should be isolated based on the communicated information comprises:

performing the behavioral analysis based on the communicated information, which comprises identification of the misbehaving node and identification of actions performed by the misbehaving node in violation of the soft rules.

15. The method as in claim 12, further comprising:

establishing a secure communication by the NMS for the received communicated information and transmitted isolation instructions.

16. The method as in claim 12, wherein the isolation instructions comprise routing isolation instructions to ignore routing protocol messages from the misbehaving node.

17. The method as in claim 12, wherein the isolation instructions comprise network-layer isolation instructions to ignore network-layer messages from the misbehaving node.

18. The method as in claim 12, wherein the isolation instructions comprise link-layer isolation instructions to ignore link-layer messages from the misbehaving node.

19. The method as in claim 18, wherein the isolation instructions comprise a security key not shared with the misbehaving node.

21. The method as in claim 12, wherein the isolation instructions comprise instructions for the misbehaving node, the transmitting the isolation instructions comprising transmitting the isolation instructions from the NMS to the misbehaving node.

22. The method as in claim 12, further comprising:

communicating the one or more rules from the NMS into the computer network.

23. The method as in claim 12, wherein at least one of either determining whether the misbehaving node should be isolated based on the communicated information or determining isolation instructions regarding how to isolate the misbehaving node from the computer network is based on an importance of the misbehaving node.

24. The method as in claim 12, wherein determining whether the misbehaving node should be isolated based on the communicated information further comprises:

receiving communicated information regarding the misbehaving node from a plurality of detecting nodes;

aggregating and analyzing the communicated information; and

determining whether the misbehaving node should be isolated based on the aggregated and analyzed communicated information.

25. An apparatus, comprising:

one or more network interfaces to communicate in computer network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

receive communicated information regarding a misbehaving node from a detecting node in a computer network, the misbehaving node detected based on the misbehaving node acting in violation of one or more rules;

determine whether the misbehaving node should be isolated based on the communicated information;

determine isolation instructions regarding how to isolate the misbehaving node from the computer network in response to determining to isolate the misbehaving node; and

transmit the isolation instructions to one or more nodes in the computer network.